Load workflow and machine-identity seam snapshots

{
    "endpoint": "GET /v1/identity/workflow-machine",
    "snapshot": {
        "webhookSignatureMode": "hmac-sha256-signed-webhook",
        "workflowBindings": [
            {
                "id": "identity_subject_seed",
                "trigger": "tinyship.user.created",
                "subjectLane": "identity_subject_seam",
                "downstreamSeam": "session.contract + billing.contract"
            },
            {
                "id": "commerce_account_link_sync",
                "trigger": "tinyship.order.paid",
                "subjectLane": "account_link_seam",
                "downstreamSeam": "billing.contract + admin.control-plane"
            },
            {
                "id": "claims_role_org_refresh",
                "trigger": "tinyship.organization.membership.updated",
                "subjectLane": "claims_role_org_mapping_seam",
                "downstreamSeam": "admin authProvider + canAccess"
            }
        ],
        "machinePrincipals": [
            {
                "id": "onesay-admin-automation",
                "purpose": "admin-control-plane-runtime-snapshot",
                "authenticationMode": "m2m-client-credentials"
            },
            {
                "id": "onesay-commerce-callback-ingress",
                "purpose": "tinyship-webhook-verification",
                "authenticationMode": "signed-webhook-plus-network-policy"
            }
        ],
        "preparedAt": "2026-04-01T16:20:00Z"
    }
}